There are several simple perl parsers for wtmp files, like wtmp.pl
by "Brocade Blue"
http://brocadeblue.blogspot.com/2012/10/perl-script-to-parse-wtmp-logs.html
Full source of wtmp.pl
with minor typos fixed:
#!/usr/bin/perl
@type = (
"Empty", "Run Lvl", "Boot", "New Time", "Old Time", "Init",
"Login", "Normal", "Term", "Account"
);
$recs = "";
while (<>) {
$recs .= $_;
}
foreach ( split( /(.{384})/s, $recs ) ) {
next if length($_) == 0 ;
my ( $type, $pid, $line, $inittab, $user, $host, $t1, $t2, $t3, $t4, $t5 ) =
$_ =~ /(.{4})(.{4})(.{32})(.{4})(.{32})(.{256})(.{4})(.{4})(.{4})(.{4})(.{4})/s;
if ( defined $line && $line =~ /\w/ ) { ##FILTER
$line =~ s/\x00+//g;
$host =~ s/\x00+//g;
$user =~ s/\x00+//g;
printf(
"%s %-8s %-12s %10s %-45s \n",
scalar( gmtime( unpack( "I4", $t3 ) ) ),
$type[ unpack( "I4", $type ) ],
$user, $line, $host
);
}
}
printf "\n"
The script may not work on 64-bit machines. The "384" and long line with (.{4})
should be fixed for 64-bit environment.
PS: to see really all records, disable the expression in the if
marked with "##FILTER
".